Independent Rust implementation of Mandiant's capa. Detects capabilities in PE, ELF, .NET, shellcode and Mach-O, with unmodified capa rules.
-
Updated
Nov 4, 2026 - Rust
Independent Rust implementation of Mandiant's capa. Detects capabilities in PE, ELF, .NET, shellcode and Mach-O, with unmodified capa rules.
Scored MITRE ATT&CK verdict engine (noisy-OR confidence), ELF/PE capability inference, attribution hashes (imphash/symhash/ssdeep/TLSH), file magic + embedded-file carving, IOC extraction, YARA on file + memory dump, pcap network intel (DNS/SNI/JA3), TOML config, report schema_version. Verified on live traffic; full test + fuzz coverage."
A 132-probe capability suite for the Polkadot App runtime. Every probe has a verified safe exit; every report is machine-diffable.
To associate your repository with the capability-detection topic, visit your repo's landing page and select "manage topics."